In 2025, Z-CERT, the cybersecurity expertise centre for Dutch healthcare, recorded at least ten successful cyberattacks on care organisations. The European agency ENISA places the health sector firmly in the risk zone, pointing to a wide gap between the sector's importance to society and its digital resilience. In April 2026 came the ransomware attack on ChipSoft, a major supplier of health IT and electronic health records in the Netherlands. Patient data, including medical data, was taken; several care organisations took systems and portals offline as a precaution. On 7 May 2026, general practitioners and pharmacists in Almere were unreachable for hours after a fire in a data centre. These figures and incidents are public, but they rarely reach the table in a meeting.
Anyone working in healthcare recognises the picture behind the numbers. Colleagues who simply want to do what is needed get stuck in a thicket of rules, committees and protocols. They end up in an exhaustion that eventually sounds like "this is just how it is", "the GDPR doesn't allow it", or "you're not allowed to use AI". Legislation such as the MDR, the AI Act and national cybersecurity law is then something the average doctor never gets round to at all.
At the same time, the sector seems to be missing something essential. A patient with a cancer diagnosis asks in the consulting room why this has happened to her, and turns over every stone to find an answer herself. That urgency is often absent when it comes to digital insecurity, as though it does not really touch us as a sector. Yet the law can be a shared foundation, in the way it is in traffic. There we know the rules and we apply them, wherever we are.
The GDPR is emphatically not a prohibition law. It is a duty-of-care regime. It grew out of a fundamental right nationally and a human right internationally, protecting our private sphere in order to serve people. What is missing is the translation of those rules into the oath every doctor has taken. Through four themes we show how the law can support professional values, and with them the Hippocratic oath.
Theme 1. Health information under the direction of the profession
The GDPR treats health data as a special category, with extra protection. Article 9(2)(h) allows health data to be processed for care purposes, provided the processing takes place within the care relationship, under professional secrecy and with appropriate safeguards. That secrecy is anchored in law, in the GDPR itself and, in the Netherlands, in the medical treatment contract act (WGBO) and the act on the use of citizen service numbers in healthcare (Wabvpz). Most member states have comparable provisions.
The core of the doctor-patient relationship is therefore legally protected. What arises in the consulting room stays confidential, unless doctor and patient decide otherwise together or the law requires otherwise. But that protection has to be carried through technically and organisationally into every system that supports the care relationship. The fact that the institution is formally the controller and the supplier the processor is a necessary design choice. The starting point remains the two people having the conversation.
In practice this means shared direction and shared transparency. Doctor and patient see together which data exist, who uses them and for what purpose. Where consent is required, it is organised so that it is understandable and can be withdrawn. Where another legal basis applies, the patient stays informed and involved. Confidentiality is not an administrative requirement but a professional precondition. A patient only opens up if it is confidential, and without that openness the view of her health situation stays incomplete.
Theme 2. Getting technology into care safely
The MDR, the IVDR and the AI Act exist to make technology demonstrably safer, traceable and responsibly deployable before it reaches patients. Medical devices, in-vitro diagnostics and high-risk AI systems must be assessed, monitored and adjusted. This is exactly what doctors already want: tools where it is clear what they do, what they are based on, and which can be taken out of circulation before harm occurs.
The friction is not in the rules. It is in the moment at which doctor and patient enter the picture. A product is designed, certified and offered; only then are doctor and patient brought in. By that point the decisions that matter have been made: which problem the product solves, how it fits the workflow, which data it leans on and which risks are considered acceptable.
When doctors and patients think along with technology developers from the start, they feel co-responsible and they act accordingly. The legal frameworks are then not there to block innovation, but to make sure that the exception where things go wrong is not left to chance.
The Cyber Resilience Act raises the bar for suppliers of digital products: security has to be part of design, maintenance and vulnerability management across the life cycle. That gives a care team something to hold on to when holding each other to account, each for their own contribution. Suppliers can only fulfil that role if doctors and patients keep feeding them what they see in practice. Bringing in the best and naming what has to improve is part of the profession.
Theme 3. Organising securely is human work
The NIS2 directive and its national implementations ask for clear governance and accountability: organise yourself so that you keep pace with developments. In the Netherlands this took effect through the Cybersecurity Act in August 2026. A data breach is more than a privacy matter. Missing data, or data you cannot be sure is correct, can disrupt care just as badly.
Unavailability and loss of integrity affect patient safety as directly as a breach of confidentiality. The result is always the same and equally painful: clinical decisions based on quicksand.
Appropriately secured, available and sound: those three requirements are interwoven, running straight through every collaboration between organisations. One weak spot touches the whole system. That makes digital security a task for the entire ecosystem, and that is where the trap lies. What belongs to everyone soon belongs to no one. This only changes when each party takes its own part and can be held to account for what it does.
Doctors do not have to experience this only as an imposed duty. They can claim digital security professionally, as a precondition for good care. Due care is the heart of it. NIS2 places responsibility explicitly with executives, including attention to the chain of suppliers that often carries the digital infrastructure. A doctor is entitled to expect the institution to have this in order.
Because doctor and patient are themselves increasingly mobile, another picture is taking shape: a digital layer that moves with them, under their shared direction. Where data are now often locked into separate systems per institution, a personal and interoperable health layer can emerge. Not by making source systems redundant, but by making data findable, transferable and comprehensibly available to patient and clinician. AI can help build that layer faster and more intelligently, provided direction, provenance and reliability stay clear.
Technology is moving quickly. AI models can now help find vulnerabilities in software. The same capacity that makes an attacker faster can also strengthen the defender. Those who organise themselves well find the weak spots and close them before an attacker does. That way technology keeps serving health instead of threatening it.
A doctor has long been unable to deliver good care alone. What happens in the consulting room leans on systems, on data, and on decisions made by people who never see the patient, whether they realise it or not. The oath is therefore no longer the doctor's alone. Everyone who contributes to health carries it.
In the end it comes down to people taking their role: make clear who is responsible for what, and be prepared to hold each other to it. Technology supports, people do the work.
Theme 4. Learning across borders
Directive 2005/36/EC recognises that a doctor can use her qualification throughout the EU. Practice is more stubborn: language requirements, country-specific procedures and recognition processes lasting months. Something similar applies to health data. The GDPR, and in the Netherlands the Wabvpz, have given citizens the right to access and transfer their data for years. The EHDS regulation builds on that, with better access to one's own record and transferability to a clinician of one's choosing. But citizens often cannot find their data, or not in a form that is usable elsewhere.
Cross-border learning becomes concrete when a patient seeks help in another EU country and her history does not travel with her, or when a doctor sees a rare case that is already routine somewhere else. The European infrastructures being built for this, such as MyHealth@EU, mainly connect national systems. That is necessary, but it follows the same route that already proved difficult within national borders.
The translation is the same layer, now across borders: one that travels with doctor and patient, including when they change institution or country. Portability is the precondition, and the law creates room for it. What a doctor and patient record together can then contribute to the knowledge network of colleagues and to research and innovation, without disappearing from their view.
Conclusion
Digital legislation does not stand opposed to good care. It should be read as an extension of professional care values. In each of the four themes above it points in the same direction as the oath (see the box). The frameworks were built with good intentions, from values that hold up. But better care does not come out of lawyers and IT professionals adding new layers on top. That only nails things down further.
Healthcare does digital, but it is not digital yet. That is the step that counts now. Not by creating more distance between rules and practice, but by bringing the law back to what it is meant for: protection of people. That starts with everyone who contributes to health.
The oath, updated
I promise that I will:
- Treat health information confidentially;
- Manage health information carefully together with my patients, make it accessible, and let it contribute to the knowledge network of colleagues and others who serve health;
- Keep taking responsibility for interpreting that information in its context;
- Steer technological development, including AI, towards what serves the health of my patient and of society.
References
This article was first published in Dutch by ICT&health
Authors
Add ICT&health on Google
Show more content from ICT&health in Google Search.
